@entrorove/skill 0.1.32 → 0.1.34

package/local-contracts.mjs

@@ -14,6 +14,7 @@ import { array, binding, change, confirmation, enumeration, evidence, evidenceAr
 const schemas = {};
 const base = { repositoryRoot: text, home: text };
 const flow = { ...base, flowId: identifier };
+const fixedRoundingPolicy = object({ decimalPlaces: { const: 2 }, mode: { const: 'half-away-from-zero' } }, ['decimalPlaces', 'mode']);
 const step = { ...flow, stepId: identifier };
 function add(names, properties, required = [], alternatives) {
   const schema = object(properties, required);
@@ -54,8 +55,8 @@ add('rollback', { ...step, snapshotId: identifier }, ['repositoryRoot', 'flowId'
 const check = { anyOf: [{ type: 'boolean' }, { type: 'object', properties: { status: text }, required: ['status'] }] };
 add('final-gate', { ...base, ...binding, audit: check, test: check, operations: check, evidence: array(evidence), preflight: record }, ['audit', 'test', 'operations', 'evidence']);
 schemas['final-gate'] = { oneOf: [schemas['final-gate'], FINAL_GATE16_INPUT_SCHEMA, FINAL_GATE16_READ_INPUT_SCHEMA] };
-add('formula-evaluate', { formula, values: decimalValues }, ['formula']);
-add('formula-graph', { formulas: array(formulaEntry), inputs: decimalValues }, ['formulas']);
+add('formula-evaluate', { formula, values: decimalValues, roundingPolicy: fixedRoundingPolicy }, ['formula']);
+add('formula-graph', { formulas: array(formulaEntry), inputs: decimalValues, roundingPolicy: fixedRoundingPolicy }, ['formulas']);
 add('formula-final-gate', { engine: record, flowId: identifier, stepId: identifier }, ['engine']);
 add('calculation-final-gate', { ...step, enginePath: relativePath }, ['repositoryRoot', 'enginePath']);
 add('run-approved-plan', { repositoryRoot: text, planPath: relativePath, approvalPath: text, signerConfigPath: nullable(text) }, ['repositoryRoot', 'planPath', 'approvalPath', 'signerConfigPath']);
@@ -114,9 +115,37 @@ Object.assign(schemas, ARCHGUARD_LOCAL_OPERATION_SCHEMAS, CALCTOOL_LOCAL_OPERATI
 export const LOCAL_OPERATION_SCHEMAS = Object.freeze(schemas);
 const ajv = new Ajv({ strict: true, strictRequired: false, allErrors: true });
 const validators = new Map(Object.entries(schemas).map(([operation, schema]) => [operation, ajv.compile(schema)]));
+const FORMULA_ARITY = { add: [1, Infinity], mul: [1, Infinity], sub: [2, 2], div: [2, 2], safeDivide: [2, 2], percentOf: [2, 2], round: [1, 1], if: [3, 3] };
+function formulaArityError(node, path) {
+  if (!node || typeof node !== 'object' || Array.isArray(node) || typeof node.op !== 'string') return undefined;
+  const bounds = FORMULA_ARITY[node.op];
+  if (!bounds) return undefined;
+  const count = Array.isArray(node.args) ? node.args.length : -1;
+  if (count < bounds[0] || count > bounds[1]) {
+    const expected = bounds[0] === bounds[1] ? `exactly ${bounds[0]}` : `at least ${bounds[0]}`;
+    return `${path}.args: operator "${node.op}" requires ${expected} arguments; received ${count < 0 ? 'non-array args' : count}`;
+  }
+  for (const [index, child] of node.args.entries()) {
+    const failure = formulaArityError(child, `${path}.args[${index}]`);
+    if (failure) return failure;
+  }
+  return undefined;
+}
+function formulaInputHint(operation, input) {
+  if (operation === 'formula-evaluate') return formulaArityError(input?.formula, 'formula');
+  if (operation === 'formula-graph' && Array.isArray(input?.formulas)) {
+    for (const [index, entry] of input.formulas.entries()) {
+      const failure = formulaArityError(entry?.expression, `formulas[${index}].expression`);
+      if (failure) return failure;
+    }
+  }
+  return undefined;
+}
 export function validateLocalInput(operation, input) {
   const validate = validators.get(operation);
   if (!validate) throw Object.assign(new Error(`Unsupported local operation: ${operation}`), { code: 'ENTROROVE_OPERATION_UNKNOWN' });
+  const hint = formulaInputHint(operation, input);
+  if (hint) throw Object.assign(new Error(`Invalid ${operation} input: ${hint}`), { code: 'ENTROROVE_INPUT_INVALID' });
   if (!validate(input)) {
     const details = validate.errors.map(error => `${error.instancePath || '/'} ${error.message}`).join('; ');
     throw Object.assign(new Error(`Invalid ${operation} input: ${details}`), { code: 'ENTROROVE_INPUT_INVALID' });

package/local-error.mjs

@@ -1,4 +1,14 @@
 export const LOCAL_ERROR_SCHEMA = 'entrorove.local-error/1.0';
+export const LOCAL_ERROR_CODE_CATALOG = Object.freeze({
+  ENTROROVE_INPUT_INVALID: Object.freeze({ disposition: 'terminal', stability: 'stable' }),
+  ENTROROVE_OPERATION_UNKNOWN: Object.freeze({ disposition: 'terminal', stability: 'stable' }),
+  ENTROROVE_LOCAL_FAILURE: Object.freeze({ disposition: 'terminal', stability: 'stable' }),
+  DIV_ZERO: Object.freeze({ disposition: 'terminal', stability: 'stable' }),
+  ENTROROVE_MUTATE_NOT_ACCEPTED: Object.freeze({ disposition: 'needs-human', stability: 'stable' }),
+  ENTROROVE_MUTATION_AUTHORITY_REQUIRED: Object.freeze({ disposition: 'needs-human', stability: 'stable' }),
+  ENTROROVE_BUDGET_LEASE_EXPIRED: Object.freeze({ disposition: 'retriable', stability: 'stable' }),
+  ENTROROVE_GIT_READER_UNSUPPORTED: Object.freeze({ disposition: 'terminal', stability: 'stable' }),
+});
 
 const BLOCKED_CODES = new Set([
   'ENTROROVE_MUTATE_NOT_ACCEPTED', 'ENTROROVE_MUTATION_AUTHORITY_REQUIRED',
@@ -16,8 +26,16 @@ export function localErrorStatus(error) {
     ? 'blocked' : 'failed';
 }
 
+export function localErrorDisposition(code) {
+  const catalogued = LOCAL_ERROR_CODE_CATALOG[code];
+  if (catalogued) return catalogued.disposition;
+  if (/_LEASE_EXPIRED$|_BUSY$|_RECONNECT/.test(code)) return 'retriable';
+  if (BLOCKED_CODES.has(code) || /(?:AUTHORITY_REQUIRED|NOT_ACCEPTED|REVOKED)$/.test(code)) return 'needs-human';
+  return 'terminal';
+}
+
 export function localErrorEnvelope(error, fallbackCode = 'ENTROROVE_LOCAL_FAILURE') {
   const code = typeof error?.code === 'string' && error.code ? error.code : fallbackCode;
   const message = typeof error?.message === 'string' && error.message ? error.message : 'Local operation failed';
-  return { schemaVersion: LOCAL_ERROR_SCHEMA, status: localErrorStatus({ ...error, code }), code, message };
+  return { schemaVersion: LOCAL_ERROR_SCHEMA, status: localErrorStatus({ ...error, code }), code, disposition: localErrorDisposition(code), message };
 }

package/local-execution.mjs

@@ -275,7 +275,29 @@ export async function finalGate(input) {
     guarantee: 'Original engine, frozen role plans and actual three-party checks are required' };
 }
 
-export const LOCAL_CAPABILITIES = Object.freeze({ schemaVersion: LOCAL_SCHEMA, operations: Object.freeze(Object.keys(LOCAL_OPERATION_SCHEMAS)), operationSchemas: LOCAL_OPERATION_SCHEMAS, stateDirectory: '~/.entrorove', forbidGitBranch: true, forbidWorktree: true, evidenceSchema: EVIDENCE_SCHEMA, budgets: READ_BUDGETS, validatorRunner: RUNNER_CAPABILITIES, workflowRunner: WORKFLOW_LOCAL_CAPABILITIES });
+const LOCAL_OPERATION_GROUPS = Object.freeze(['core', 'budget', 'scope', 'merge', 'chain', 'handoff', 'archguard', 'calctool', 'swarm', 'validator', 'formula', 'evidence']);
+const PASS_REQUIRED_OPERATIONS = new Set(['mutation-snapshot-attest', 'mutate-gate', 'gate-issue', 'gate-verify', 'guarded-write',
+  'merge-verified', 'rollback', 'archguard-contract-create', 'archguard-contract-update', 'archguard-checkpoint', 'archguard-scope-request',
+  'budget-handoff', 'budget-transition', 'spawn-bind', 'peer-complete', 'complete']);
+function operationGroup(operation) {
+  if (operation.startsWith('archguard-')) return 'archguard';
+  if (operation.startsWith('calctool-')) return 'calctool';
+  if (operation.includes('handoff')) return 'handoff';
+  if (operation.startsWith('budget-')) return 'budget';
+  if (operation.startsWith('chain-')) return 'chain';
+  if (operation.startsWith('formula-')) return 'formula';
+  if (operation.startsWith('merge-') || ['branch-create', 'branch-create-virtual', 'branch-list', 'branch-switch', 'diff-report', 'preflight', 'ledger-query'].includes(operation)) return 'merge';
+  if (operation.startsWith('peer-') || ['coordinate', 'spawn-bind', 'complete', 'lease-verify'].includes(operation)) return 'swarm';
+  if (operation.startsWith('evidence-')) return 'evidence';
+  if (operation.startsWith('probe') || operation === 'reassess' || operation.startsWith('snapshot') || operation.includes('scope')) return 'scope';
+  if (operation === 'final-gate' || operation.includes('verify') || operation.includes('validate')) return 'validator';
+  return 'core';
+}
+const LOCAL_OPERATION_METADATA = Object.freeze(Object.fromEntries(Object.keys(LOCAL_OPERATION_SCHEMAS).map(operation => [operation, Object.freeze({
+  group: operationGroup(operation), requiresPass: PASS_REQUIRED_OPERATIONS.has(operation),
+})])));
+export const LOCAL_CAPABILITIES = Object.freeze({ schemaVersion: LOCAL_SCHEMA, operations: Object.freeze(Object.keys(LOCAL_OPERATION_SCHEMAS)), operationSchemas: LOCAL_OPERATION_SCHEMAS,
+  operationMetadata: LOCAL_OPERATION_METADATA, groups: LOCAL_OPERATION_GROUPS, stateDirectory: '~/.entrorove', forbidGitBranch: true, forbidWorktree: true, evidenceSchema: EVIDENCE_SCHEMA, budgets: READ_BUDGETS, validatorRunner: RUNNER_CAPABILITIES, workflowRunner: WORKFLOW_LOCAL_CAPABILITIES });
 export function capabilities() { return LOCAL_CAPABILITIES; }
 export const guardedWriteFile = guardedWrite;
 export const verifyMutationPassFile = verifyMutationPass;

package/local-scope-config-imports.mjs

@@ -0,0 +1,192 @@
+import { createHash } from 'node:crypto';
+import path from 'node:path';
+import ts from 'typescript';
+const missing = (error) => ['ENOENT', 'ENOTDIR'].includes(error?.code ?? '');
+function literal(value, field) {
+    if (typeof value !== 'string' || !value || value !== value.trim() || value !== value.normalize('NFC')
+        || /[\\:\u0000-\u001f\u007f]/.test(value) || value.startsWith('/') || value.startsWith('~')) {
+        throw new Error(`Scope tsconfig ${field} requires a supported repository-relative literal path`);
+    }
+    return value;
+}
+function within(directory, value, allowRoot = false) {
+    const resolved = path.posix.normalize(path.posix.join(directory, literal(value, 'path'))).replace(/\/+$/, '');
+    if (resolved === '..' || resolved.startsWith('../') || resolved.startsWith('/')
+        || resolved.split('/').some(part => ['node_modules', '.git', '.entrorove', '.aimlock', '.archguard'].includes(part))) {
+        throw new Error('Scope tsconfig path escapes the authorized repository');
+    }
+    if (resolved === '.') {
+        if (!allowRoot)
+            throw new Error('Scope tsconfig mapping requires a literal candidate within the repository');
+        return '';
+    }
+    return resolved;
+}
+function pathsOption(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new Error('Scope tsconfig paths requires an object of literal mappings');
+    const result = Object.create(null);
+    const entries = Object.entries(value);
+    if (entries.length > 512)
+        throw new Error('Scope tsconfig paths exceeds 512 mappings');
+    for (const [key, targets] of entries) {
+        if (!key || key !== key.trim() || key !== key.normalize('NFC') || /[\\:\u0000-\u001f\u007f]/.test(key)
+            || key.startsWith('/') || key.split('/').some(part => part === '.' || part === '..') || key.split('*').length > 2) {
+            throw new Error('Scope tsconfig paths supports only exact or single-wildcard mappings');
+        }
+        if (!Array.isArray(targets) || !targets.length || targets.length > 128 || targets.some(target => typeof target !== 'string')) {
+            throw new Error('Scope tsconfig paths targets must be a nonempty bounded string array');
+        }
+        result[key] = targets.map(target => {
+            literal(target, 'mapping');
+            if (target.split('*').length > 2 || (target.includes('*') && !key.includes('*'))) {
+                throw new Error('Scope tsconfig paths target has an unsupported wildcard mapping');
+            }
+            return target;
+        });
+    }
+    return result;
+}
+function parsedConfig(relative, source) {
+    const parsed = ts.parseConfigFileTextToJson(relative, source);
+    if (parsed.error)
+        throw new Error(`Scope tsconfig JSONC syntax is invalid (diagnostic ${parsed.error.code})`);
+    if (!parsed.config || typeof parsed.config !== 'object' || Array.isArray(parsed.config))
+        throw new Error('Scope tsconfig must contain a configuration object');
+    return parsed.config;
+}
+function pathMatch(paths, specifier) {
+    if (!paths)
+        return null;
+    if (Object.hasOwn(paths, specifier))
+        return { targets: paths[specifier], wildcard: '' };
+    let selected = null;
+    let prefixLength = -1;
+    for (const [key, targets] of Object.entries(paths)) {
+        const star = key.indexOf('*');
+        if (star < 0)
+            continue;
+        const prefix = key.slice(0, star);
+        const suffix = key.slice(star + 1);
+        if (prefix.length > prefixLength && specifier.startsWith(prefix) && specifier.endsWith(suffix)
+            && specifier.length >= prefix.length + suffix.length) {
+            selected = { targets, wildcard: specifier.slice(prefix.length, specifier.length - suffix.length) };
+            prefixLength = prefix.length;
+        }
+    }
+    return selected;
+}
+function importCandidates(resolution, specifier) {
+    if (typeof specifier !== 'string' || !specifier)
+        throw new Error('Scope tsconfig import specifier must be nonempty');
+    if (specifier.startsWith('node:') || specifier.startsWith('./') || specifier.startsWith('../'))
+        return [];
+    if (specifier !== specifier.trim() || /[\\:\u0000-\u001f\u007f*]/.test(specifier)
+        || specifier.startsWith('/') || specifier.split('/').some(part => part === '.' || part === '..')) {
+        throw new Error('Scope tsconfig import alias or candidate uses an unsupported path');
+    }
+    const match = pathMatch(resolution?.paths, specifier);
+    if (match) {
+        const base = resolution.baseUrl ?? resolution.pathsOrigin;
+        return [...new Set(match.targets.map(target => within(base, target.replace('*', match.wildcard))))];
+    }
+    if (specifier.startsWith('@/') || specifier.startsWith('#') || specifier.startsWith('~/')) {
+        throw new Error('Scope local import alias requires an actual tsconfig or package-import mapping');
+    }
+    return resolution?.baseUrl !== undefined ? [within(resolution.baseUrl, specifier)] : [];
+}
+export async function scopeTsconfigImports(read, fromFile, configPath) {
+    const canonical = within('', fromFile);
+    if (canonical !== fromFile)
+        throw new Error('Scope tsconfig source path must be canonical within the repository');
+    const observed = new Map();
+    const absent = new Set();
+    let bytes = 0;
+    const metadata = async (relative) => {
+        if (absent.has(relative))
+            return null;
+        if (observed.has(relative))
+            return Buffer.from(observed.get(relative).contentBase64, 'base64').toString('utf8');
+        let item;
+        try {
+            item = await read(relative);
+        }
+        catch (error) {
+            if (missing(error)) {
+                absent.add(relative);
+                return null;
+            }
+            ;
+            throw error;
+        }
+        const data = Buffer.from(item.contentBase64, 'base64');
+        if (item.path !== relative || data.toString('base64') !== item.contentBase64
+            || createHash('sha256').update(data).digest('hex') !== item.sha256 || !Buffer.from(data.toString('utf8')).equals(data)) {
+            throw new Error('Scope tsconfig metadata lost its actual path, UTF-8 content or hash');
+        }
+        bytes += data.length;
+        if (data.length > 1024 * 1024 || bytes > 16 * 1024 * 1024)
+            throw new Error('Scope tsconfig metadata exceeds its bounded read size');
+        observed.set(relative, item);
+        return data.toString('utf8');
+    };
+    const load = async (relative, ancestors, depth = 0) => {
+        if (depth >= 10)
+            throw new Error('Scope tsconfig extends exceeds the 10-configuration depth bound');
+        let source = await metadata(relative);
+        if (source === null && !relative.endsWith('.json')) {
+            relative += '.json';
+            source = await metadata(relative);
+        }
+        if (source === null)
+            throw new Error('Scope tsconfig extends references a missing actual configuration');
+        if (ancestors.has(relative))
+            throw new Error('Scope tsconfig extends contains a configuration cycle');
+        const config = parsedConfig(relative, source);
+        const directory = path.posix.dirname(relative) === '.' ? '' : path.posix.dirname(relative);
+        let inherited = { pathsOrigin: directory };
+        if (config.extends !== undefined) {
+            const extended = literal(config.extends, 'extends');
+            if (!extended.startsWith('./') && !extended.startsWith('../'))
+                throw new Error('Scope tsconfig npm extends is unsupported; use an actual repository-relative extends');
+            inherited = await load(within(directory, extended), new Set([...ancestors, relative]), depth + 1);
+        }
+        const options = config.compilerOptions === undefined ? {} : config.compilerOptions;
+        if (!options || typeof options !== 'object' || Array.isArray(options))
+            throw new Error('Scope tsconfig compilerOptions must be an object');
+        const own = options;
+        return { ...inherited,
+            ...(own.baseUrl === undefined ? {} : { baseUrl: within(directory, literal(own.baseUrl, 'baseUrl'), true) }),
+            ...(own.paths === undefined ? {} : { paths: pathsOption(own.paths), pathsOrigin: directory }) };
+    };
+    let directory = path.posix.dirname(canonical);
+    let resolution = null;
+    if (configPath !== undefined) {
+        if (within('', configPath) !== configPath || !/(?:^|\/)(?:ts|js)config(?:\.[^/]+)?\.json$/.test(configPath))
+            throw new Error('Scope import context requires an actual repository-relative tsconfig or jsconfig');
+        resolution = await load(configPath, new Set());
+    }
+    while (configPath === undefined) {
+        const prefix = directory === '.' ? '' : `${directory}/`;
+        const relative = await metadata(`${prefix}tsconfig.json`) !== null ? `${prefix}tsconfig.json`
+            : await metadata(`${prefix}jsconfig.json`) !== null ? `${prefix}jsconfig.json` : null;
+        if (relative !== null) {
+            resolution = await load(relative, new Set());
+            break;
+        }
+        if (directory === '.')
+            break;
+        directory = path.posix.dirname(directory);
+    }
+    if (resolution?.paths)
+        for (const targets of Object.values(resolution.paths))
+            for (const target of targets) {
+                within(resolution.baseUrl ?? resolution.pathsOrigin, target.replace('*', '__scope_wildcard__'));
+            }
+    return { candidates: specifier => importCandidates(resolution, specifier), mapped: specifier => {
+            if (typeof specifier !== 'string' || !specifier)
+                throw new Error('Scope tsconfig mapping lookup requires a nonempty specifier');
+            return pathMatch(resolution?.paths, specifier) !== null;
+        }, observations: [...observed.keys()].sort()
+            .map(relative => ({ path: relative, sha256: observed.get(relative).sha256 })) };
+}

package/local-scope-repository.mjs

@@ -11,6 +11,7 @@ import { workspaceImport, workspaceIndex } from './local-scope-workspaces.mjs';
 import { assertBudgetRunnerAllowed } from './local-budget-reads.mjs';
 import { observeBudgetScopeGit, scopeGitBudgetEnforced } from './local-scope-git.mjs';
 import { scopeGitMetadata } from './local-scope-git-reads.mjs';
+import { scopeTsconfigImports } from './local-scope-config-imports.mjs';
 
 const execute = promisify(execFile);
 async function git(root, args, allowed = [], input = { repositoryRoot: root }) {
@@ -179,48 +180,83 @@ function importSpecifiers(content, filename) {
   }
 }
 const sourceExtension = /\.(?:[cm]?[jt]sx?|vue)$/i;
-async function resolveImport(root, from, specifier, workspace, input) {
+function declarationModules(content, from) {
+  if (!/\.d\.[cm]?ts$/i.test(from)) return new Set();
+  const parsed = ts.createSourceFile(from, content.toString('utf8'), ts.ScriptTarget.Latest, true, ts.ScriptKind.TS);
+  return new Set(parsed.statements.filter(node => ts.isModuleDeclaration(node) && ts.isStringLiteral(node.name)
+    && node.modifiers?.some(modifier => modifier.kind === ts.SyntaxKind.DeclareKeyword)).map(node => node.name.text));
+}
+async function resolveImport(root, from, specifier, workspace, input, aliases, configPath, declarations) {
   if (/^(?:https?:|file:|data:)/i.test(specifier)) scopeFail('ENTROROVE_IMPORT_UNSUPPORTED', 'remote source imports cannot be inspected as local facts');
+  if (declarations.has(specifier)) return null;
+  const label = /^[A-Za-z0-9@._/~+-]{1,256}$/.test(specifier) ? specifier : '[unsupported specifier]';
+  let candidates;
+  try { candidates = aliases.candidates(specifier); }
+  catch (error) { scopeFail('ENTROROVE_IMPORT_UNRESOLVED', `${from}: ${error.message}; specify its actual build config with importContexts`); }
+  for (const candidate of candidates) {
+    const resolved = await resolveLocalImport(root, candidate, false);
+    if (resolved) return resolved;
+  }
+  if (aliases.mapped(specifier)) scopeFail('ENTROROVE_IMPORT_UNRESOLVED', `${from}: ${label} has no actual resolvable source file in its build config`);
   const localPackage = !specifier.startsWith('.') ? workspaceImport(workspace, specifier) : null;
   if (!specifier.startsWith('.') && !localPackage) {
     if (builtinModules.includes(specifier) || (specifier.startsWith('node:') && builtinModules.includes(specifier.slice(5)))) return null;
-    const boundary = await packageBoundary(root, from, input);
+    const boundary = await packageBoundary(root, configPath ?? from, input);
     if (boundary.manifestPath) {
       const manifest = JSON.parse((await scopeRead(root, boundary.manifestPath, input)).content.toString('utf8'));
       const name = specifier.startsWith('@') ? specifier.split('/').slice(0, 2).join('/') : specifier.split('/')[0];
       if (['dependencies', 'devDependencies', 'peerDependencies', 'optionalDependencies'].some(field => Object.hasOwn(manifest[field] ?? {}, name))) return null;
     }
-    scopeFail('ENTROROVE_IMPORT_UNRESOLVED', 'bare imports require a builtin, declared dependency, or actual workspace export; unresolved aliases cannot be assumed external');
+    scopeFail('ENTROROVE_IMPORT_UNRESOLVED', `${from}: ${label} requires a builtin, declared dependency, or actual workspace export`);
   }
   const relative = localPackage ?? path.posix.normalize(path.posix.join(path.posix.dirname(from), specifier));
+  return resolveLocalImport(root, relative);
+}
+async function resolveLocalImport(root, relative, required = true) {
   if (relative.startsWith('../') || relative === '..') scopeFail('ENTROROVE_PATH_UNSAFE', 'local import escapes the repository');
   const replacements = /\.js$/.test(relative) ? [relative.replace(/\.js$/, '.ts'), relative.replace(/\.js$/, '.tsx')] : [];
-  for (const candidate of [relative, ...replacements, ...['.js', '.mjs', '.cjs', '.ts', '.tsx', '.jsx', '/index.js', '/index.ts'].map(ext => relative + ext)]) {
+  for (const candidate of [relative, ...replacements, ...['.js', '.mjs', '.cjs', '.ts', '.tsx', '.jsx', '.vue', '.json', '.d.ts', '.d.mts', '.d.cts', '/index.js', '/index.ts', '/index.d.ts'].map(ext => relative + ext)]) {
     const item = await scopeTarget(root, candidate, true);
     if (item.exists && item.stat.isFile()) return candidate;
   }
-  scopeFail('ENTROROVE_IMPORT_UNRESOLVED', 'a local import has no resolvable source file');
+  if (required) scopeFail('ENTROROVE_IMPORT_UNRESOLVED', 'a local import has no resolvable source file');
+  return null;
 }
 export async function importGraph(root, originals, input = { repositoryRoot: root }) {
   const pending = originals.filter(file => file.exists !== false).map(file => file.path); const visited = new Map(); const edges = []; let dynamic = false;
+  const dynamicSources = [];
   const workspace = await workspaceIndex(root, input);
+  const metadata = new Map(workspace.metadata.map(item => [item.path, item]));
   while (pending.length) {
     const relative = pending.shift(); if (visited.has(relative)) continue;
     if (visited.size >= 1000) scopeFail('ENTROROVE_SCOPE_LIMIT', 'import graph exceeds the 1000-file inspection bound');
     const read = await scopeRead(root, relative, input); const boundary = await packageBoundary(root, relative, input);
     visited.set(relative, { path: relative, sha256: read.sha256, module: boundary.path, boundary });
     if (!sourceExtension.test(relative)) continue;
+    const contexts = (input.importContexts ?? []).filter(context => relative === context.sourcePrefix || relative.startsWith(`${context.sourcePrefix}/`))
+      .sort((a, b) => b.sourcePrefix.length - a.sourcePrefix.length);
+    const configPath = contexts[0]?.configPath;
+    const aliases = await scopeTsconfigImports(async target => {
+      const item = await scopeRead(root, target, input);
+      return { path: target, sha256: item.sha256, contentBase64: item.content.toString('base64') };
+    }, relative, configPath);
+    for (const observed of aliases.observations) metadata.set(observed.path, observed);
+    const declarations = declarationModules(read.content, relative);
     const imports = importSpecifiers(read.content, relative); dynamic ||= imports.dynamic;
+    if (imports.dynamic) dynamicSources.push({ path: relative, sha256: read.sha256 });
     for (const specifier of imports.specifiers.sort()) {
-      const target = await resolveImport(root, relative, specifier, workspace, input);
-      edges.push({ from: relative, to: target, external: target === null, specifier });
+      const target = await resolveImport(root, relative, specifier, workspace, input, aliases, configPath, declarations);
+      edges.push({ from: relative, to: target, external: target === null, specifier,
+        ...(declarations.has(specifier) ? { declarationOnly: true, declarationPath: relative } : {}) });
       if (target !== null && !visited.has(target)) pending.push(target);
     }
   }
   const nodes = [...visited.values()].sort((a, b) => a.path.localeCompare(b.path));
   await stableScope(root, nodes, input);
-  await stableScope(root, workspace.metadata, input);
-  return { nodes, edges: edges.sort((a, b) => `${a.from}:${a.specifier}`.localeCompare(`${b.from}:${b.specifier}`)), dynamic, complete: !dynamic, workspaceMetadata: workspace.metadata };
+  const workspaceMetadata = [...metadata.values()].sort((a, b) => a.path.localeCompare(b.path));
+  await stableScope(root, workspaceMetadata, input);
+  return { nodes, edges: edges.sort((a, b) => `${a.from}:${a.specifier}`.localeCompare(`${b.from}:${b.specifier}`)),
+    dynamic, complete: !dynamic, dynamicSources: dynamicSources.sort((a, b) => a.path.localeCompare(b.path)), workspaceMetadata };
 }
 export async function collectScopeFacts(root, requested, baselineRef, knownFiles = [], input = { repositoryRoot: root }) {
   const selected = await scopeFiles(root, requested, knownFiles); const files = [];

package/manifest.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": "entrorove.skill-manifest/1.0",
   "name": "entrorove",
-  "version": "0.1.32",
+  "version": "0.1.34",
   "endpoint": "https://entrorove.com",
   "requestSchemaVersion": "entrorove.skill.request/2.0",
   "supportedRequestSchemaVersions": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@entrorove/skill",
-  "version": "0.1.32",
+  "version": "0.1.34",
   "type": "module",
   "bin": {
     "entrorove": "cli.mjs"
@@ -76,7 +76,12 @@
     "local-task-handoff-write-archive.mjs",
     "local-task-handoff-write-receipts.mjs",
     "remote-client.mjs",
+    "scope-runner-client.mjs",
     "cloud-task-client.mjs",
+    "cloud-watch-client.mjs",
+    "cloud-event-stream.mjs",
+    "ide-presentation.mjs",
+    "automatic-feedback-client.mjs",
     "remote-transport.mjs",
     "local-credential.mjs",
     "local-invocations.mjs",
@@ -122,6 +127,7 @@
     "local-scope-files.mjs",
     "local-scope-repository.mjs",
     "local-scope-signature.mjs",
+    "local-scope-config-imports.mjs",
     "local-scope-snapshot.mjs",
     "local-scope-state.mjs",
     "local-scope-workspaces.mjs",

package/release-state.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": "entrorove.release-state/1.0",
-  "version": "0.1.32",
-  "digest": "615bc63383071e3a1356d129b2c072e1641744f6b82def3ec0c2f56fa68a39a4",
+  "version": "0.1.34",
+  "digest": "88b67ef8c4be3ddf86777218a7324b095e37b2e6df30a002ac267a48548e2a31",
   "files": {
     "local-final-gate16.mjs": "b30caab08441449ad556a6e9a3cefbf91190f0b3f7370f46d2a21156375aa8e3",
     "local-final-gate16-checks.mjs": "1dd30e9666d458d8b12ca6e4975f6f0ac8450c3ea9cbecc7401ae037f66b589a",
@@ -44,23 +44,23 @@
     "local-autocoord17-waits.mjs": "2b0a713987822548a94e1ed3a9a891532db45383797dfc5d5bc8d1e35593cf25",
     "local-validator-isolation17.mjs": "48e94604e28b8fddd567dfb35ff60b73fd094a5803bd49f076388b7f310f92aa",
     "local-calctool-composition17.mjs": "ac89fcb41ab0d0d9b47c1b5696945281b0894eb064820775e36a011c76314e6a",
-    "cli.mjs": "6d455d8e22fccd24332726de6821a8a99f628d057648c9aae7c6262d89745722",
+    "cli.mjs": "b890c2173195edc9ccbaa1f9d1b45a845cad0f1838c300d90a77b1f776c8f178",
     "review-client.mjs": "3491eef68ed533174b31db3c53febb6519b8f088f71a9964644714a9a4c03c77",
     "version.mjs": "1f392147d72c40af4b03b307ea607075fb815af5174fa07e254b95fe12dbf3e7",
-    "SKILL.md": "20c09094ffd094fa59f73a26b8cbb987cf40a8247368bb5b6417695831ed2a70",
-    "CAPABILITY-MAP.md": "128ecc8d90b2c17846ce6f0c650eada9e7fa7240f5d3c03b31e3ee01135557b8",
+    "SKILL.md": "11469bd5f51e008c26492d2e01401959451c259e04699dd4b8c833701c27d0b2",
+    "CAPABILITY-MAP.md": "f1dd06d99f191daa27f7b1520a3d6d26b1ceba139d30cd287d2b9bfd79459923",
     "AGREEMENT.md": "f93a68e92c457200dd024610e65f74e478b8f60860f951da818b70561f1b9bf8",
-    "package.json": "77e29f7740cc2a2284490a992a9945fbb4a3ad3ac044f4ff9a59b1aa83e44ae0",
+    "package.json": "559c14f546a781839ed5e741602d26f888a9c98399a397b788c0fc17da1c4083",
     "manifest.json": "ab06e307795bc9da5add926752b6c4dbdaf18625090261a035aa356a679c504f",
-    "release.mjs": "1e6155d10b5e6384414233847815742e13f0945101c5f53253ad9ca827766beb",
-    "local-cli.mjs": "ecc85bc5f36a5663fef004e59525374dc7883d3889f5a0cfe219ae5e84b2d3ea",
+    "release.mjs": "1b1925df27dd26164874d291c2dbac9a13010fca7892a9d5b529a3e6e99c0139",
+    "local-cli.mjs": "a79037d7383a29822b465e6db1c862a43d47cc344f05b6651c849633c49d19f7",
     "local-state-lock.mjs": "1dbf64264642a0851faf043e07ee9f66d2ad0508e9f799b0626246e42fae893e",
-    "local-execution.mjs": "97dfad5e889e679e9cc34434005342526502795abba21078fa40673788073153",
+    "local-execution.mjs": "cdada6df6dc8831cebb58a629b56c4b3f8e1bf9aae4e3fdc121521ba20839383",
     "local-integrity.mjs": "4f325376e536999c3b00245f66aac9ef1ae762c33012b363c231622008f72805",
     "local-evidence-verification.mjs": "9b7dea31777505272f63616fd62af7603338f703bb1285fc565d6451715c7ce0",
     "local-formula.mjs": "706d5ec0cb2caf95a547531a81ca746fe246d4c53d902e03595a3b360e8c85af",
     "local-ledger.mjs": "2009fb68aadcd7292b72f1d0d99f378d03644be1c5b4b4150d9f6a0b3f7c15ce",
-    "local-error.mjs": "66484e2e27c9870a17dc0f1cf64d108ea384ad9fb41b7adc3aacb243ae65fe2e",
+    "local-error.mjs": "9dc42763ca7013cde607543308e029796d68f3b020a5a3b4ad9e68815e38d0f5",
     "blueprint-criterion-wire.mjs": "fb6b7dcce0b97a699e3e8968372767a3fddd83fedc750998573f789177243072",
     "blueprint-criterion-runner.mjs": "761c0e670b4b20c6bed53e5ca5d0178759505c3977ea2ed1b7223383c534bc4c",
     "local-chain-bindings.mjs": "b8eff999ccd17b53c614a3c9f5376da78fcaa8632bb3e07bc1adcceda2e75f6c",
@@ -89,7 +89,7 @@
     "local-scope-candidate.mjs": "8f0bd9606e70d4a0ebacdd3cd600ec3afed85e2bb3e1760aa1144cf55d4e028a",
     "local-scope-context.mjs": "79753abfc6c76089d17f003a1be537dfaea10d6731c542f7fc53f2a9996ed164",
     "local-scope-files.mjs": "0671ac4baef610a55ea6c1db6ebca7a4b6cfda45edb8aeaa828019e2a26f5a76",
-    "local-scope-repository.mjs": "f3fa673fdb4b37bb085ce0caab6a24be2b9f056e12d59bd81aac798d85dd507c",
+    "local-scope-repository.mjs": "af7fe24408509dcebe39bdfc6fcef6adcf66f6ad09473149f920d5e921a48d1a",
     "local-scope-git.mjs": "53bbbb6c4795db711b5bc164591a6ad79a561427da046d6bbe997dae6eb82829",
     "local-scope-git-reads.mjs": "d18d4441664aa59ad8360ee16a69fc0282e7530705d5ae7950944a8158448bb4",
     "local-scope-git-comparison.mjs": "d86e559843087ae851795c9fb16b844dc46cc461fb5da37dbca0f6ba0d06450b",
@@ -113,12 +113,18 @@
     "runtime/git-native-linux-v1.mjs": "cf5cb91426a105e62c0f07a8a230dec592dba46f85a3f708b4c4e8cfcd1126c6",
     "runtime/git-native-darwin-v1.mjs": "f88aab72dc86f94eb1115784872957cb8ed0f74205ae70e1ecd1939e7790e310",
     "local-scope-signature.mjs": "bd05e8cf9e23f9511a16844974362297b9e9d11930ff7b8ad2a490e8d7660fe9",
+    "local-scope-config-imports.mjs": "16053142410dd647f13360f29fb3680c3e3a3ebc38019e43af6db05896d92a33",
     "local-scope-snapshot.mjs": "c0f851470b98863a1d187825ed61ee6072d1c057b178fdc85ae29af02a3b250f",
     "local-scope-state.mjs": "8b600a91fc0068d7a8c0bb752ddba7ed30ada93daafb118d6cba2368fd94cb27",
     "local-scope-workspaces.mjs": "a44c34537e5ed2dcaf193a985e5bc05957989fbb160a650f9e37ba7d66eb2de8",
     "local-task-routing.mjs": "e26d6f1ba134ffe1da2a49b4fb6bb6dfa5617671f774a08e719d04f202cf5eca",
-    "remote-client.mjs": "ce16258faffb09c9db19609d47a0af6f63fcbc256feb35ba7a14bbb89e69cc6e",
-    "cloud-task-client.mjs": "ca6c5af7f7c2507680fcce3b8ab739a50ebed88f5a202cffbecea962861bbebb",
+    "remote-client.mjs": "3c95a81bcad3e53f63071a87929dae4b7c71e6a45034263269c731d9d494d529",
+    "cloud-task-client.mjs": "ecb6124ea5e6249f31fb95cb68d13d821d2daea8768fe47ddf6dcf82fc3392cc",
+    "scope-runner-client.mjs": "940c841e2c56e92793e5bf65e713bf4087151f721d0ecb659e0a75d6fdefeab9",
+    "cloud-watch-client.mjs": "bfbe636c10af467855776f9d29008d9ce13420b66bcc91b5bf8f6ef79fb2aefe",
+    "cloud-event-stream.mjs": "e0eec9fc3e0613094523929634f25030df5ca5c5b5fe2c1e1a4586ab10574808",
+    "ide-presentation.mjs": "026bf425d06276300ca748a8e22f66596ee52ff268fe0e6ffeff230885533d9a",
+    "automatic-feedback-client.mjs": "817e76b7ca4b5a282b9408ac9cf3daf7e09085db5aacbb49d74d8b6bcc4bb611",
     "remote-transport.mjs": "5e5a8c0b490371f7f5a052cffbeee6202d4cf713dff1c43b6d910fe944f8429c",
     "local-credential.mjs": "2a302a7f67b5ea8dc73453fc96ab33db349b59ca11fa9456e48ca1d9669d877c",
     "local-invocations.mjs": "f6ac4c41c1a5ec34de358c4cca210ca8e403b3a913150a43bb55ec9be55d9998",
@@ -139,8 +145,8 @@
     "workflow-local-request.mjs": "4e24c543ce386292a87dc9cd41f90d23375f12079cacffc515c8cd01fd571780",
     "task-message-entry.mjs": "31d10056cb905237cd5649e8eb067009ff1612ec5dc1061e0373209fbc0b646a",
     "task-message-cli.mjs": "3ca65e96c28129b3bd5cac962d106e0859a1f17df1f6a66ee543c6efc22f918d",
-    "local-contracts.mjs": "43715cd73460ccea734501a3dd5667184da0f6a5b0189e038319a439ba52fc76",
-    "local-contract-types.mjs": "5d244237fc69052b2fa83098022761bae929e8b75a0683883b620711bc132050",
+    "local-contracts.mjs": "e6c6b9b8b8b89e991c5689d935e26ccd92d398405ebced298817d673095bca1e",
+    "local-contract-types.mjs": "85e71fa4dd67e351a4b67573c740bcdb1661cede53f097189f11837771e75e91",
     "local-archguard-ast.mjs": "cefd835312a623e83bf48e4d8e1f76ac6a8adc56c35843705c16967d16bec4e6",
     "local-archguard-checkpoint.mjs": "37896902520cc995720c96288e4a5ed3585952b55c9c35be281f91fa754c71ec",
     "local-archguard-components.mjs": "a8fb3d0fd787f9160905013fd333cc0b9e8cf624cce797461f36f4ab31d170ad",

package/release.mjs

@@ -86,10 +86,13 @@ const sourceFiles = [
   'runtime/git-native-linux-v1.mjs',
   'runtime/git-native-darwin-v1.mjs',
   'local-scope-signature.mjs',
+  'local-scope-config-imports.mjs',
   'local-scope-snapshot.mjs',
   'local-scope-state.mjs',
   'local-scope-workspaces.mjs',
   'local-task-routing.mjs', 'remote-client.mjs', 'cloud-task-client.mjs',
+  'scope-runner-client.mjs',
+  'cloud-watch-client.mjs', 'cloud-event-stream.mjs', 'ide-presentation.mjs', 'automatic-feedback-client.mjs',
   'remote-transport.mjs', 'local-credential.mjs', 'local-invocations.mjs',
   'local-task-handoff-fence.mjs',
   'local-task-handoff-storage.mjs', 'local-task-handoff-overlay-wire.mjs', 'local-task-handoff-completion-wire.mjs',
@@ -257,7 +260,15 @@ function releaseNote(changed) {
   if (suppliedZh && suppliedEn) return {
     zh: suppliedZh.replaceAll(/\s+/g, ' '), en: suppliedEn.replaceAll(/\s+/g, ' '),
   }
-  const labels = withFinalGate16ReleaseLabels({ ...calctoolReleaseLabels, ...mutationReleaseLabels, ...swarmReleaseLabels, ...coordination17ReleaseLabels, ...nativeReadReleaseLabels, ...feedbackReleaseLabels, ...invocationReleaseLabels, ...chainReleaseLabels,
+  if (changed.includes('scope-runner-client.mjs')) return {
+    zh: '补齐账号与任务隔离的本地签名器和真实快照接入，解析实际别名及类型声明；动态依赖仅进入受限规划，保留独立写入核验。',
+    en: 'Connected account-bound scope signers and real snapshots, resolved actual aliases and declarations, and retained restricted planning for unresolved dynamic imports with separate mutation verification.',
+  }
+  const distinct = distinctReleaseLabels(changed, releaseLabels())
+  return { zh: `更新了${distinct.map(label => label.zh).join('、')}。`, en: `Updated ${distinct.map(label => label.en).join(', ')}.` }
+}
+function releaseLabels() {
+  return withFinalGate16ReleaseLabels({ ...calctoolReleaseLabels, ...mutationReleaseLabels, ...swarmReleaseLabels, ...coordination17ReleaseLabels, ...nativeReadReleaseLabels, ...feedbackReleaseLabels, ...invocationReleaseLabels, ...chainReleaseLabels,
     'blueprint-criterion-wire.mjs': { zh: '蓝图验收标准执行授权', en: 'Blueprint criterion execution authority' },
     'blueprint-criterion-runner.mjs': { zh: '蓝图验收标准实际执行器', en: 'Blueprint criterion process runner' },
     'local-archguard-ast.mjs': { zh: 'Archguard 架构合同与执行守卫', en: 'Archguard architecture contract and execution guard' },
@@ -344,12 +355,11 @@ function releaseNote(changed) {
     'task-message-entry.mjs': { zh: '任务消息实际投递入口', en: 'task message host delivery entry' },
     'task-message-cli.mjs': { zh: '任务消息命令与适配器', en: 'task message command and adapter' },
     'cloud-task-client.mjs': { zh: '云端沙箱任务路由与逐任务选择', en: 'cloud sandbox task routing and per-task choice' },
+    'cloud-watch-client.mjs': { zh: 'IDE 实时云端进度与推广展示', en: 'live IDE cloud progress and promotion display' },
+    'cloud-event-stream.mjs': { zh: 'IDE 实时云端进度与推广展示', en: 'live IDE cloud progress and promotion display' },
+    'ide-presentation.mjs': { zh: 'IDE 实时云端进度与推广展示', en: 'live IDE cloud progress and promotion display' },
+    'automatic-feedback-client.mjs': { zh: '原调用自动评价回执核验', en: 'original invocation automatic evaluation receipt verification' },
   })
-  const distinct = distinctReleaseLabels(changed, labels)
-  return {
-    zh: `更新了${distinct.map(label => label.zh).join('、')}。`,
-    en: `Updated ${distinct.map(label => label.en).join(', ')}.`,
-  }
 }
 
 async function writeAll(changes) {

package/releases.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.1.34",
+    "date": "2026-10-12",
+    "zh": "补回旧版八技能的 IDE 可见云端选择、真实事件进度与独立推广提示；服务端自动评价绑定原调用并返回可验证回执，支持只读恢复；修复旧式 UUID 调用漏计用量，保持账号隔离及沙箱／调用计数分离。",
+    "en": "Restore visible IDE cloud choice, authoritative live progress and separate promotion notices from the original eight-skill workflow. Persist account-bound automatic invocation evaluations with verifiable receipts and read-only recovery; meter legacy UUID calls without mixing skill and sandbox counters."
+  },
+  {
+    "version": "0.1.33",
+    "date": "2026-10-12",
+    "zh": "补齐账号与任务隔离的本地签名器和真实快照接入，解析实际别名及类型声明；动态依赖仅进入受限规划，保留独立写入核验。",
+    "en": "Connected account-bound scope signers and real snapshots, resolved actual aliases and declarations, and retained restricted planning for unresolved dynamic imports with separate mutation verification."
+  },
   {
     "version": "0.1.32",
     "date": "2026-10-11",